#pragma once

EXTERN_C
NTKERNELAPI PVOID PsGetProcessSectionBaseAddress(PEPROCESS Process);
EXTERN_C NTSTATUS __stdcall ZwSetInformationProcess(
	HANDLE ProcessHandle,
	PROCESSINFOCLASS ProcessInformationClass,
	PVOID ProcessInformation,
	ULONG ProcessInformationLength);

#ifndef _WIN64
EXTERN_C 
PEPROCESS FindProcessByNameInBaseName(char* name);
EXTERN_C 
PEPROCESS FindProcesByNameInFullName(WCHAR* name);
EXTERN_C 
UINT_PTR GetProcessActiveProcessLinksOffset();
EXTERN_C 
NTSTATUS SetProcessHeaderFlags(PEPROCESS process);
EXTERN_C 
VOID LogAllActiveProcessList();
EXTERN_C 
VOID EnumThreadListOfProcess(char* name);
EXTERN_C
BOOLEAN ProtectProcessByName(char* name);
#else



EXTERN_C
PEPROCESS FindProcessByNameInBaseName(char* name);

EXTERN_C
NTSTATUS AttachProcess(HANDLE pid,KAPC_STATE* apc_state);

EXTERN_C
NTSTATUS UnAttachProcess();

//通过Object 回调 保护进程
EXTERN_C
NTSTATUS ProtectProcessByPid(HANDLE pid);

EXTERN_C
VOID UnProtectProcess();

EXTERN_C
PEPROCESS GetProcessById(HANDLE pid);

EXTERN_C
PEPROCESS FindProcess(char* processName);

//拷贝系统进程Token,可以有图标
EXTERN_C
NTSTATUS RaiseToSystemPrivi(PEPROCESS process);



EXTERN_C
NTSTATUS SetProcessCallbackDo(HANDLE pid, ULONG64 FuncAddressR3);

EXTERN_C
NTSTATUS SetProcessCallbackTest(HANDLE pid,ULONG64 FuncAddress);

EXTERN_C
NTSTATUS test2();

#endif


